Anything of value to the organization, such as data, systems, people, facilities, or reputation. Assets are what you are trying to protect in risk management.

A potential cause of an unwanted incident, which may result in harm to a system or organization. Examples include attackers, insiders, natural disasters, and power failures.

A weakness that can be exploited by a threat. Examples include unpatched software, weak passwords, misconfigurations, and lack of monitoring.

The level of risk that exists before any controls or mitigations are applied.

The potential for loss or damage when a threat exploits a vulnerability affecting an asset; often expressed conceptually as Risk = Likelihood × Impact.

Anything of value to the organization, such as data, systems, people, facilities, or reputation.

A potential cause of an unwanted incident that may result in harm to a system or organization.

Risk Management: Identifying, Analyzing, and Treating Enterprise Risks — CompTIA Security+ (SY0-701) Mastery Course: Complete Exam-Ready Preparation

Q: An organization discovers that its public web server is running outdated software with a known remote code execution flaw. No attack has occurred yet. Which term BEST describes the outdated software in this scenario?

A vulnerability. The outdated software with a known flaw is a **vulnerability**: a weakness that could be exploited. The potential for exploitation and resulting damage would be the **risk**. A threat is the potential cause (for example, an attacker), and an incident is when the event has already happened.

Q: Management reviews the risk register and decides that a low-likelihood, low-impact risk related to a lab test system will not receive any new controls. They document this decision and assign an owner to monitor it annually. Which risk treatment option have they chosen?

Accept. They have chosen to **accept** the risk. They are aware of it, document the decision, and do not add new controls. Mitigation would involve new controls, transfer would involve insurance or contracts, and avoidance would remove the activity or system entirely.

Big Picture: Why Risk Management Matters

Where Risk Fits

Risk management decides what to protect first, how much to invest, and which controls matter most. It sits between governance (direction) and incident response (what happens after events).

The Risk Cycle

Typical cycle: 1) Identify risks, 2) Analyze and assess likelihood and impact, 3) Treat (mitigate, transfer, avoid, accept), 4) Monitor and review over time.

Link to GRC

Risk management connects policies and standards to actual controls and operations. Laws and frameworks expect documented, repeatable risk management.

Exam-Relevant Idea

Risk management is central to governance, prioritization, and control selection. It is about informed trade-offs, not eliminating all risk.

Core Risk Concepts: Assets, Threats, Vulnerabilities, Risk

Defining Assets

Asset: Anything of value to the organization (data, systems, people, reputation, facilities). Assets are what you are trying to protect.

Threats and Vulnerabilities

Threat: Potential cause of an unwanted incident. Vulnerability: Weakness that a threat can exploit (unpatched apps, weak passwords, misconfigurations).

What is Risk?

Risk is the potential for loss or damage when a threat exploits a vulnerability affecting an asset. Often summarized as `Risk = Likelihood × Impact`.

Inherent vs Residual

Inherent risk is before controls; residual risk is after controls. Exam trap: weakness = vulnerability; possible future bad event = risk or threat scenario.

Step 1: Identifying Enterprise Risks

What We Identify

Risk identification looks at assets, threats, vulnerabilities, and business processes. You cannot manage what you have not identified.

Techniques

Use interviews, workshops, checklists, past incident reviews, threat modeling, and asset inventories to spot risks, especially in a hybrid environment.

Writing Risk Statements

Phrase risks as threat–vulnerability–impact: "An external attacker exploits unpatched VPN software to gain remote access, leading to data theft and downtime."

Exam Angle

If asked for the first step in risk management, the best answer is usually asset identification or risk identification, not jumping straight to controls.

Step 2: Qualitative Risk Analysis (Likelihood and Impact)

Why Qualitative?

Qualitative risk analysis uses likelihood and impact scales to prioritize risks without needing exact dollar values. It is fast and widely used.

Scales and Ratings

Define scales (for example, Low/Medium/High). Rate each risk for likelihood and impact, then combine ratings using a risk matrix.

Matrix Logic

High likelihood + High impact → critical. Low likelihood + Low impact → low. Borderline cases depend on the organization’s risk appetite.

Qualitative vs Quantitative

Qualitative: categories and expert judgment. Quantitative: numeric values and money (ALE, SLE). Security+ emphasizes the qualitative approach.

Worked Example: Building a Simple Risk Matrix

Scenario Setup

Three risks: R1 ransomware via phishing, R2 insider data theft, R3 data center power outage. We will rate each qualitatively.

Define Scales

Likelihood: 1 Low, 2 Medium, 3 High. Impact: 1 Low, 2 Medium, 3 High. This is enough for many Security+ style questions.

Rate the Risks

R1: 3×3 → Critical. R2: 2×3 → High. R3: 2×3 → High, but if DR site exists, impact = 2 → Medium. Controls change ratings.

Matrix Insight

Placing risks on a matrix shows which to tackle first and how new controls (like DR) reduce impact and overall risk.

Risk Registers and Reporting

What is a Risk Register?

A risk register is a structured list of risks with details like description, likelihood, impact, owner, treatment, and status. It tracks risks over time.

Key Fields

Include assets, threats, vulnerabilities, ratings, risk owner, chosen treatment (mitigate, transfer, avoid, accept), and related controls.

Role in GRC

Leaders use the register to align controls and budgets with highest risks. It is a core artifact in governance, risk, and compliance.

Exam Distinction

A risk register tracks risks and treatments, not just assets. It is different from asset inventories or configuration databases.

Risk Treatment Options: Mitigate, Transfer, Avoid, Accept

Mitigate

Mitigate (reduce) by adding or strengthening controls to lower likelihood or impact, like patching, MFA, segmentation, or backups.

Transfer

Transfer risk via insurance or contracts (cloud SLAs, payment processors). You shift impact or responsibility, but not ultimate accountability.

Avoid

Avoid risk by stopping the risky activity: do not launch, disable the feature, or exit the market. You remove the exposure entirely.

Accept

Accept risk when it is low or controls are too costly. Management documents and approves taking the risk without extra controls.

Thought Exercise: Choosing the Right Treatment

Apply what you have learned. For each scenario, decide which treatment option fits best: mitigate, transfer, avoid, or accept. Think it through before checking your reasoning.

Scenario A:

A startup runs a small internal wiki containing non-sensitive documentation. There is a known minor vulnerability in the wiki software that would require a costly upgrade to fix. The wiki is only accessible from inside the network.

What is the most reasonable treatment?

Scenario B:

A retailer processes credit card payments. Storing card data on-premises would require heavy PCI DSS compliance work. Instead, they consider using a third-party payment gateway that handles and stores all card data.

What treatment is this?

Scenario C:

A manufacturing plant has one legacy control system that is highly vulnerable and cannot be patched. If compromised, it could cause significant downtime and safety risks. The business can redesign the process to remove this system entirely, though it will be expensive.

Which treatment describes removing the system?

Scenario D:

A company in a flood-prone area purchases cyber and business interruption insurance. They also move backups to a cloud provider with an uptime SLA.

Identify the treatment(s) in play.

After you decide, compare with the explanations below.

Suggested reasoning:

A: Accept (documented, low-impact, internal-only, upgrade cost high). You might add minimal compensating controls but essentially accept.
B: Transfer (risk of storing card data is shifted to the payment gateway via contract and compliance obligations).
C: Avoid (stopping use of the vulnerable system removes that risk entirely).
D: Mainly transfer (insurance, cloud SLA), plus some mitigation if they improve backup and recovery processes.

Connecting Risk to Control Selection and Projects

From Risk to Action

Risk assessment matters only if it changes what you do: it should drive control selection, architecture choices, and project priorities.

Map Risks to Controls

For each high risk, identify root causes and map them to technical, administrative, and physical controls that reduce likelihood or impact.

Example: Ransomware

Critical ransomware risk → email filtering, EDR, least privilege, backups, plus training and incident response playbooks as a focused project.

Exam Clue

If asked which control to implement first, choose one that tackles high-likelihood, high-impact risks and offers broad, feasible risk reduction.

Quiz 1: Core Concepts and Analysis

Test your understanding of key risk management ideas.

An organization discovers that its public web server is running outdated software with a known remote code execution flaw. No attack has occurred yet. Which term BEST describes the outdated software in this scenario?

A threat
A vulnerability
A risk
An incident

Show Answer

Answer: B) A vulnerability

The outdated software with a known flaw is a **vulnerability**: a weakness that could be exploited. The potential for exploitation and resulting damage would be the **risk**. A threat is the potential cause (for example, an attacker), and an incident is when the event has already happened.

Quiz 2: Treatment Options and Registers

Apply your knowledge of treatment options and documentation.

Management reviews the risk register and decides that a low-likelihood, low-impact risk related to a lab test system will not receive any new controls. They document this decision and assign an owner to monitor it annually. Which risk treatment option have they chosen?

Mitigate
Transfer
Avoid
Accept